Updated Slack plugin documentation for improved named credentials (#754)

nebula-logger/plugins/slack/README.md

@@ -44,9 +44,35 @@ Check out [Slack's webhooks documentation](https://api.slack.com/messaging/webho
 3. Go to Setup --> Custom Metadata Types --> Logger Parameters. There are 2 parameters to configure (shown in screenshot below)
    - Parameter 'Slack Endpoint' - You can configure this webhook in 1 of 2 ways:
      - Easier but less secure: Paste the Slack webhook URL into the `Value__c` field and save the Plugin Parameter record.
-     - More secure: Create a new Named Credential, using the webhook URL as the endpoint. Within the Parameter 'Slack Endpoint', enter `callout:<your named credential>` into the `Value__c` field and save the Plugin Parameter record
+     - More secure: Create a new Named Credential ([see section below for step-by-step instructions](#setting-up-named-credentials)), using the webhook URL as the endpoint. Within the Parameter 'Slack Endpoint', enter `callout:<your named credential>` into the `Value__c` field and save the Plugin Parameter record
    - Parameter 'Slack Notification Logging Level' - Set the desired logging level value that should trigger a Slack notification to be sent the Logger Plugin Parameter 'Slack Notification Logging Level`. It controls which logging level (ERROR, WARN, INFO, DEBUG, FINE, FINER, or FINEST) will trigger the Slack notifications to be sent.
 
 The Slack integration should now be setup & working - any new logs that meet the specified notification logging level (step 6 above) will send a Slack notification.
 
 ![Slack plugin: parameters](./.images/slack-plugin-parameters.png)
+
+#### Setting up Named Credentials
+*Note: these instructions are for setting up the improved Named Credentials, as legacy credentials are deprecated as of Winter '23. For more info, see [Salesforce's documentation](https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm&type=5).*
+
+1. **Create a new External Credential.** This will define how Salesforce should authenticate with the Slack webhook (which in this case is no authentication).
+   - Go to the Named Credentials page in setup, click  `New` under the External Credentials tab.
+   - Enter a name (for example, `Nebula Slack Webhook (No Auth)`)
+   - Select `No Authentication` for the Authentication Protocol.
+1. **Create a Principle for the External Credential.** This will define the credentials that should be used when calling out to the Slack webhook (again, in this case, no credentials are needed, but we will still need to grant access to the principal).
+   - In the Principals section of the External Credential you just created, click `New`. 
+   - Enter a parameter name (for example: `Default` or `Standard`, as there will only ever be one principal for this credential). 
+
+   ![Slack plugin: external credential](./.images/slack-plugin-external-credential.png)
+
+3. **Create a new Named Credential.** This is where the webhook URL will be stored.
+   - Go back to the main Named Credentials page and click `New` in the Named Credentials tab. 
+   - Enter a name for the Named Credential (for example: `Nebula Slack Webhook`).
+   - Paste the Slack webhook URL into the URL field.
+   - In the External Credential dropdown, select the one you created in step 1.
+4. **Grant the Platform Integration User access to the External Credential.** This will allow the Platform Integration user (the running user listening for Log Platform Events) to make callouts to the Slack webhook.
+   - Create a new permission set or open an existing one
+   - Go to the External Credential Principal Access section of the permissions set and grant access to the External Credential you created in step 1. 
+   - Assign the permission set to the Platform Integration User handles Log Platform events. 
+     - There are often multiple platform integration users. The easiest way to determine the correct one is to run this query: `SELECT CreatedBy.Username from Log__c LIMIT 1`, then assign the permission set to the user with the username returned in the query.
+
+    ![Slack plugin: named credential](./.images/slack-plugin-named-credential.png)